CVE-2017-10916
Published: 5 July 2017
The vCPU context-switch implementation in Xen through 4.8.x improperly interacts with the Memory Protection Extensions (MPX) and Protection Key (PKU) features, which makes it easier for guest OS users to defeat ASLR and other protection mechanisms, aka XSA-220.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
xen Launchpad, Ubuntu, Debian |
trusty |
Does not exist
(trusty was not-affected [code not present])
|
| upstream |
Needs triage
|
|
| xenial |
Released
(4.6.5-0ubuntu1.2)
|
|
| yakkety |
Released
(4.7.2-0ubuntu1.3)
|
|
| zesty |
Released
(4.8.0-1ubuntu2.2)
|
|
| Binaries built from this source package are in Universe and so are supported by the community. | ||
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 7.5 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | None |
| Availability impact | None |
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |